Stable Production Does Not Prove Healthy Barriers

The quiet shift can hide a changed risk picture

Steady production is reassuring. Pressure, temperature and level trends help operators understand the current condition of a process and recognise developing deviations. Yet a stable trend cannot demonstrate every function needed to prevent or limit a major accident. A safeguard may be impaired without changing the readings that operators normally watch.

Process safety concerns the prevention and mitigation of major events involving hazardous substances or energy. For an offshore production team, the practical question reaches beyond whether the plant is making its target: what protects people and the installation if control is lost? An incident-free shift is an outcome so far, rather than a test of every safeguard.

Operating condition and protection status are different

A process measurement describes a variable at a particular time. Barrier status describes the protection available against a defined hazard. A barrier might prevent a hazardous event or reduce its consequences. Its value depends on the scenario, design, condition and arrangements that support it. Teams need to understand the credited function rather than treating every alarm, procedure or item of equipment as interchangeable protection.

Two shifts can report similar production figures while facing different protection conditions. One may have its required safeguards available; the other may be operating under an approved temporary impairment arrangement. The difference must remain visible to the people making operational decisions. Familiarity with a bypass must never be mistaken for evidence that the underlying exposure has disappeared.

Hypothetical example: the separator looks normal

Consider a hypothetical separator operating at its normal liquid level while its independent high-high level trip is bypassed for maintenance. The normal control system may continue regulating level, so the process display gives no immediate reason for concern. The bypass has nevertheless changed the protection available if an upset requires that trip to act.

If an initiating failure allows level to rise, the unavailable trip cannot perform its intended protective function. The actual consequences depend on the installation and its hazard assessment; this example does not establish a specific accident sequence or claim that other safeguards are absent. It illustrates why a normal operating condition and a healthy protection system require separate evidence.

Extra operator attention should not be assumed to replace an independent automatic safeguard. Detection, workload, response time, competence and the means of intervention all matter. Whether any temporary measure is suitable must be determined through the authorised site process, with the responsible technical and operational personnel.

Make the impairment understandable at handover

An override list becomes useful when it explains the operational significance of each entry. Equipment identifiers alone may leave the incoming team unsure which hazard is affected or what has changed. Link the impaired function to the affected operation, restrictions, responsible owner and restoration arrangements.

Use the approved impairment and handover records. Resolve inconsistent information between the control-room indication, maintenance status and authorised record before relying on an assumption. An incoming operator should be able to explain the changed protection and the required response in their own words.

• Identify the affected equipment and the protective function that is unavailable or degraded.
• Confirm the current authorisation, risk assessment and approved compensating measures.
• Explain applicable operating restrictions, reassessment triggers and escalation routes.
• Confirm who owns restoration, when review is due and how completion will be verified.

Temporary controls need continuing attention

Authorisation is the start of a controlled arrangement. A job delay, additional impairment, process change or shift transition can alter the conditions considered in the assessment. Check that the approved measures remain in place and that the operation stays within its authorised restrictions. Do not extend an arrangement informally because production has remained steady.

If required protection or approved compensating measures cannot be confirmed, escalate promptly and follow the applicable procedure for restricting or stopping the affected operation. This article does not prescribe a universal shutdown threshold: those decisions depend on the installation’s safety requirements and competent assessment. Uncertainty about a safeguard should be made visible while it can still be resolved.

Restoration means confirming the protective function

Finishing maintenance and restoring a safeguard are related but distinct milestones. A work order may be complete while a bypass, inhibition or temporary configuration remains. Use the approved testing and return-to-service process to confirm the required function, record the evidence and update the operating team.

Agree ownership of the final status change. The handover should show whether protection is restored or whether restrictions remain. Avoid closing the operational concern solely because a repair has been reported complete. Testing methods, independence requirements and acceptance criteria belong to the applicable equipment and site procedures.

Look for warning signs before an incident

HSE’s HSG254 recommends checking critical risk controls and using performance information to identify deterioration early. It combines active checks with learning from failures, including failures that do not produce a major accident. This source supports the lesson’s central principle; the separator scenario and workplace questions here are our illustrative application.

Useful review questions include whether impairments are reviewed when required, restoration commitments are met and functional checks reveal unresolved defects. Repeated extensions or recurring failures deserve attention even when output remains steady. Select measures that reflect the installation’s hazards and decisions; a count of completed tasks alone can conceal their safety significance.

A practical team conversation for today

Choose one current barrier impairment and walk through its operational meaning with operations, maintenance and the responsible supervisor. Use actual authorised records rather than inventing a failure scenario for the installation. The aim is shared understanding and clear ownership of outstanding actions.

Discussion question: Which impaired barrier on our plant would most change our response to an upset—and does everyone on shift understand its status?

Daily action: Review one impairment from identification through authorisation, compensating measures, handover and restoration. Escalate any missing evidence through the approved route.

This is general process safety learning. Apply approved site procedures, the installation’s safety requirements and competent technical advice when making operational decisions.